CVE-2018-18253 Race condition in n/a
A race condition in CapMon Access Manager allows attackers to retain administrator privileges if a command crashes, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-18253?
CVE-2018-18253 is a high-severity vulnerability in n/a, published on 15 Mar 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe attempts to enforce access control by adding an unprivileged user to the local Administrators group for a very short time to execute a single command. However, the user is left in that group if the command crashes, and there is also a race condition in all cases.
Weakness: CWE-362
Which versions are affected by CVE-2018-18253?
It affects 1 product.
Products include Capmon Access Manager.
How do I fix CVE-2018-18253?
No fix has been published for CVE-2018-18253 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-18253 being exploited?
There is no known exploitation of CVE-2018-18253 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-c433-q7cj-fw94.